search

Yelp / fuzz-lightyear

A pytest-inspired, DAST framework, capable of identifying vulnerabilities in a distributed, micro-service ecosystem through chaos engineering testing and stateful, Swagger fuzzing.
Other
205 stars 25 forks source link

Non-valuable data is propagated through request sequences #65

Open AlexB1986 opened 3 years ago

AlexB1986 commented 3 years ago

Hi Team! While testing Fuzz-lightyear against Mozilla Kinto we have faced with issue related with propagating non-valuable data through request sequences. Could you please check our results?

While generating a sequence of requests method add_response() called with some response as an input: image

To extract data add_response() use for loop with dir(response). But in that case dir(response) equals to 

['__class__', '__contains__', '__delattr__', '__delitem__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__getattribute__', '__getitem__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__iter__', '__le__', '__len__', '__lt__', '__ne__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__setitem__', '__sizeof__', '__str__', '__subclasshook__', 'clear', 'copy', 'fromkeys', 'get', 'items', 'keys', 'pop', 'popitem', 'setdefault', 'update', 'values']

As a result we have non-valuable data in self.data (this data is used to construct nest request in a sequence): image

Seems that we should use response.keys() instead of dir(response):

....
for key in response.keys():
    self.data[key] = response[key]
...

Do we miss something in our reasoning? Are there any cases when dir(response) is needed?